only auth when we need it